tailnats is one of those elegantly-scoped projects that makes you think "of course somebody should have built this." It bundles a NATS JetStream message broker together with Tailscale's tsnet library into a single self-contained Go binary. The result: a message broker that joins your tailnet directly as a node, reachable at a MagicDNS name, with WireGuard-based auth and encryption baked in — no separate networking layer to configure, no TLS certs to rotate, no exposed public ports.

Why is this interesting? NATS is already famously lightweight and fast, and JetStream adds durable streams, key-value stores, and object storage on top. But deploying it securely across multiple hosts, clouds, or homelab environments usually means dealing with TLS, mTLS, firewall rules, and often a reverse proxy. By embedding tsnet, the broker becomes a first-class citizen of your tailnet — any device authorized on your Tailscale network can reach it as if it were on the LAN, and ACLs can gate access at the identity layer rather than the network layer.

This is particularly appealing for:

• Homelab operators who want a pub/sub or event-streaming backbone across a NAS, a couple of Raspberry Pis, and a cloud VPS without punching holes in routers.
• Edge/IoT developers stitching together devices in the field where a public endpoint is a liability.
• Small teams running distributed workers or agent systems that need reliable messaging but don't want to stand up dedicated infrastructure.
• Tailscale enthusiasts exploring the growing pattern of embedding tsnet into services (like the tailscale-serve, headscale, and similar projects).

The single-binary distribution model also makes it a plausible fit for small on-prem deployments where operational simplicity beats horizontal scalability. It's the kind of building block that could quietly become a favorite for anyone tired of Kubernetes-scale answers to homelab-scale problems.